Reviewed:  https://review.openstack.org/328204
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=03b762e80a9b3d33ce13b8222f4cd2b549171c51
Submitter: Jenkins
Branch:    feature/crypto-review

commit 03b762e80a9b3d33ce13b8222f4cd2b549171c51
Author: Janie Richling <email address hidden>
Date:   Mon Jun 6 17:19:48 2016 +0100

    Support for http footers - Replication and EC
    
    Before this patch, the proxy ObjectController supported sending
    metadata from the proxy server to object servers in "footers" that
    trail the body of HTTP PUT requests, but this support was for EC
    policies only.  The encryption feature requires that footers are sent
    with both EC and replicated policy requests in order to persist
    encryption specific sysmeta, and to override container update headers
    with an encrypted Etag value.
    
    This patch:
    
    - Moves most of the functionality of ECPutter into a generic Putter
      class that is used for replicated object PUTs without footers.
    
    - Creates a MIMEPutter subclass to support multipart and multiphase
      behaviour required for any replicated object PUT with footers and
      all EC PUTs.
    
    - Modifies ReplicatedObjectController to use Putter objects in place
      of raw connection objects.
    
    - Refactors the _get_put_connections method and _put_connect_node methods
      so that more code is in the BaseObjectController class and therefore
      shared by [EC|Replicated]ObjectController classes.
    
    - Adds support to call a callback that middleware may have placed
      in the environ, so the callback can set footers. The
      x-object-sysmeta-ec- namespace is reserved and any footer values
      set by middleware in that namespace will not be forwarded to
      object servers.
    
    In addition this patch enables more than one value to be added to the
    X-Backend-Etag-Is-At header. This header is used to point to an
    (optional) alternative sysmeta header whose value should be used when
    evaluating conditional requests with If-[None-]Match headers.  This is
    already used with EC policies when the ECObjectController has
    calculated the actual body Etag and sent it using a footer
    (X-Object-Sysmeta-EC-Etag). X-Backend-Etag-Is-At is in that case set
    to X-Object-Sysmeta-Ec-Etag so as to point to the actual body Etag
    value rather than the EC fragment Etag.
    
    Encryption will also need to add a pointer to an encrypted Etag value.
    However, the referenced sysmeta may not exist, for example if the
    object was created before encryption was enabled. The
    X-Backend-Etag-Is-At value is therefore changed to support a list of
    possible locations for alternate Etag values. Encryption will place
    its expected alternative Etag location on this list, as will the
    ECObjectController, and the object server will look for the first
    object metadata to match an entry on the list when matching
    conditional requests. That way, if the object was not encrypted then
    the object server will fall through to using the EC Etag value, or in
    the case of a replicated policy will fall through to using the normal
    Etag metadata.
    
    If your proxy has a third-party middleware that uses X-Backend-Etag-Is-At
    and it upgrades before an object server it's talking to then conditional
    requests may be broken.
    
    UpgradeImpact
    
    Co-Authored-By: Alistair Coles <email address hidden>
    Co-Authored-By: Thiago da Silva <email address hidden>
    Co-Authored-By: Samuel Merritt <email address hidden>
    Co-Authored-By: Kota Tsuyuzaki <email address hidden>
    
    Closes-Bug: #1594739
    Change-Id: I12a6e41150f90de746ce03623032b83ed1987ee1